The lite-backend "signature verification" was attestation theater:
build-lite-backend-artifact.sh recorded a self-attested
signature_verification.verification_status="verified" with no cryptographic
check (the "verified" SHA was simply the artifact's own SHA), and CMake's
DRAGONX_LITE_BACKEND_REQUIRE_SIGNATURE gate trusted it — so a hand-edited
manifest could link an arbitrary prebuilt backend into ObsidianDragonLite.
Per the chosen remediation (build-from-source is the trust root):
- build-lite-backend-artifact.sh: reject --artifact/--no-build (prebuilt) and
all --signature-* flags; the backend is always built from the vendored
in-tree source (third_party/silentdragonxlite). Record built_from_source:true
in the manifest provenance. Usage/header updated.
- CMakeLists.txt: remove the DRAGONX_LITE_BACKEND_REQUIRE_SIGNATURE option and
its manifest signature-verification gate (kept the real required-symbol
inventory check); update the config summary line.
Full-node CMake reconfigure + build pass; script bash -n clean and the removed
flags now hard-error. (The lite-backend link path needs cargo + backend and was
not runtime-tested in this environment.)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Vendor the two local Rust crates that build the lite backend artifact into
third_party/silentdragonxlite/ (the qtlib C-ABI wrapper + the silentdragonxlitelib
core, with proto/res and all the lite-send fixes), and point
build-lite-backend-artifact.sh's default --backend-dir there, so the lite wallet
builds without the upstream SilentDragonXLite repo.
External build inputs are now only the Rust toolchain + git.dragonx.is + crates.io:
- the 6 librustzcash git deps point at the git.dragonx.is/DragonX/librustzcash
mirror (pinned rev acff1444), not git.hush.is;
- the Sapling params are gitignored (not committed, no Git LFS) - the build fetches
them from the git.dragonx.is/DragonX/zcash-params 'sapling-v1' release and verifies
their SHA-256 before rust-embed bakes them in (ensure_sapling_params).
For fully offline builds, cargo vendor into lib/vendor/ and add a vendored-sources
redirect (vendor/ is gitignored; the script symlinks it into the prepared dir).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Preserve the previously-uncommitted lite wallet implementation and related dev WIP
under version control:
- src/wallet/ lite services: client bridge, bridge runtime, connection, lifecycle,
sync, gateway, result parsers, state mapper, artifact contract/resolver, refresh
services, UI adapters, wallet_backend/capabilities. (Includes two small M1 fixes:
lifecycle walletReady now parses the response; default chain name -> "main".)
- src/chat/ chat protocol; tests/fixtures/ (lite + hushchat); tools/hushchat_fixture_check.cpp;
scripts/build-lite-backend-artifact.sh.
- Pre-existing modified app_network/security/wizard, network_refresh_service, sidebar,
mining_tab, bootstrap dialog, and version headers captured as-is.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
DanSandClaude Fable 5